Caddyfile リバースプロキシ＆自動HTTPS設定ジェネレーター

# ========================================================
# Caddy 2 Production Server Configuration
# Site Address: app.example.com, www.app.example.com
# Workload Profile: Current Configuration
# Generated 100% Client-Side Private on ToolsAA
# ========================================================

{
    email [email protected]
    admin off
}

app.example.com, www.app.example.com {
    reverse_proxy 127.0.0.1:3000 {

        # Standard proxy header passthrough
        header_up Host {upstream_hostport}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}

        transport http {
            dial_timeout 5s
            response_header_timeout 60s
        }
    }

    # Ultra-fast high-compression (Zstandard & Gzip)
    encode zstd gzip

    # Security Hardening & Header Manipulation
    header {
        # HTTP Strict Transport Security (HSTS 2-Year Preload)
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        # Prevent MIME-type sniffing attacks
        X-Content-Type-Options "nosniff"
        # Mitigate clickjacking framing attacks
        X-Frame-Options "DENY"
        # Cross-domain referrer policy
        Referrer-Policy "strict-origin-when-cross-origin"
        # Restrict hardware API access
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
        # Suppress fingerprinting headers
        -Server
        -X-Powered-By
    }

    # Structured Access Logging
    log {
        output file /var/log/caddy/app.example.com.access.log {
            roll_size 10mb
            roll_keep 5
            roll_keep_for 720h
        }
        format json
    }
}